{"id":698496,"url":"https://alion.io/job/semperis-senior-secops-engineer","title":"Senior SecOps Engineer","company":{"id":685815,"name":"Semperis","domain":"semperis.com","url":"https://alion.io/company/semperis","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":92,"open_postings":3,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":43,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Tel Aviv, Israel"],"countries":["IL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":97000,"max_usd":223000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Platform Engineering","optional":false},{"name":"SIEM","optional":false},{"name":"AI Agents","optional":true},{"name":"CI/CD","optional":true},{"name":"FedRAMP","optional":true},{"name":"ISO 27001","optional":true},{"name":"JavaScript","optional":true},{"name":"Kubernetes","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"SOC 2","optional":true},{"name":"SQL","optional":true},{"name":"YARA","optional":true},{"name":"YARA","optional":true}],"status":"live","first_seen_at":"2026-08-11T17:44:15Z","employer_posted_date":"2026-08-11","last_verified_at":"2026-11-01T07:25:58Z","board_verified":true,"closed_at":null,"days_open":81,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":81},"description":"At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.\nSemperis is looking for a hands-on Senior Security Operations Engineer who wants to do more than monitor alerts and hand off tickets. In this role, you will have the rare opportunity to identify security problems, understand their root causes, and work directly with the teams responsible for fixing them.\nYou will strengthen Semperis’ threat detection, incident response, vulnerability management, and cloud security operations through a combination of investigation, engineering, and automation. You will design and tune detections, lead investigations and response efforts, prioritize and route vulnerabilities and CSPM/CWP findings, improve security telemetry, and build capabilities that reduce manual effort and help the organization respond faster.\nThis is an engineering-focused SecOps role- not a traditional alert-monitoring position. You will be expected to turn operational insights into durable improvements: better detections, stronger controls, cleaner telemetry, streamlined workflows, and measurable risk reduction. You will work closely with Cloud Security, Identity and IT, AppSec, Product Engineering, Platform Engineering, GRC, and service owners to secure Semperis’ corporate and cloud environments.\nYou will also help shape how Semperis secures AI-enabled tools, agents, and automation as they become part of the way we work. If you enjoy moving from signal to solution-and want the autonomy and cross-functional access to make security improvements stick-this role is built for you.\nWhat You Will Do\nThreat Detection and Incident Response\nOperate and improve SIEM, EDR, cloud, identity, email, and security monitoring capabilities.\n\nDevelop and tune detection rules, analytics, dashboards, alert routing, and investigation playbooks.\n\nInvestigate security alerts and incidents, including scoping, evidence collection, containment, remediation coordination, and recovery tracking.\n\nSupport high-severity incident response and contribute to post-incident improvements.\n\nVulnerability and Cloud Security Operations\nLead SecOps triage of vulnerability, exposure, endpoint patching, and CSPM/CWP findings across endpoints, third-party applications, cloud environments, and other technology assets.\n\nValidate findings, assess risk using business and technical context, assign ownership, establish remediation priorities, track patching and other corrective actions, manage exceptions, and verify closure.\n\nPartner with Cloud Security on posture-management rules, alert tuning, cloud logging, and recurring misconfiguration analysis.\n\nDefine monitoring and detection requirements for new cloud services, SaaS capabilities, and significant architecture changes.\n\nMonitor privileged activity, develop detections for risky identity, endpoint, and cloud administration behavior, and support endpoint-hardening efforts focused on least privilege, reduce local-administrator access, and secure configuration.\n\nAutomation, Metrics, and Engineering\nBuild scripts, integrations, workflows, and playbooks that improve triage, enrichment, notification, containment, remediation tracking, and reporting.\n\nMonitor log-source and connector health and improve telemetry coverage across cloud, identity, endpoint, SaaS, and network sources.\n\nMaintain metrics covering MTTD, MTTR, alert quality, incident trends, detection coverage, vulnerability risk, CSPM/CWP exposure, and remediation performance.\n\nMaintain clear runbooks, technical documentation, and operational records.\n\nAI Security, Guardrails, and Monitoring\nAssess AI tools, agents, plugins, and MCP integrations for data access, identity, execution, retention, and supply chain risk.\n\nDesign and operate guardrails for least-privilege identities, read-only-by-default connectors, sandboxed execution, network-egress restrictions, and human approval before irreversible actions.\n\nMonitor prompts, retrieved content, model outputs, tool calls, agent actions, and administrative changes for prompt injection, indirect prompt injection, sensitive data exposure, unsafe code, abnormal behavior, and policy violations.\n\nOnboard AI audit and runtime telemetry into the SIEM and build detections and response playbooks for rogue tools, connector misuse, suspicious tool calls, data exfiltration, and agent compromise.\n\nRun controlled pilots and adversarial tests, measure false positives and user impact, and promote controls from monitor or flag to block based on evidence.\n\nCross-Functional Security Engineering\nTranslate security findings into clear actions, owners, priorities, and deadlines.\n\nProvide practical security guidance to engineering and IT teams.\n\nMentor analysts and engineers through technical reviews, incident walkthroughs, and knowledge sharing.\n\nBalance risk, engineering effort, availability, customer impact, and business priorities when recommending actions.\n\nWhat You Will Bring\n5+ years of hands-on experience in Security Operations, Security Engineering, Detection Engineering, Incident Response, or related field.\n\nStrong experience with SIEM operations, detection engineering, alert triage, investigation, and incident response.\n\nPractical experience with vulnerability management, endpoint patching and hardening, CSPM/CWP, cloud security posture, or attack-surface analysis.\n\nExperience with Azure, AWS, or comparable cloud environments; multi-cloud experience is a plus.\n\nStrong understanding of identity and access risks, privileged activity, risky sign-ins, and cloud administration.\n\nUnderstanding modern AI security risks, including prompt injection, indirect prompt injection, excessive agency, data leakage, tool misuse, and AI supply-chain risk.\n\nAbility to query and analyze security data using KQL, SQL, or equivalent language.\n\nAbility to automate using Python, PowerShell, JavaScript, or a comparable language, including API integration.\n\nExperience with endpoint, email, SaaS, cloud, and identity security telemetry.\n\nStrong technical writing and communication skills, including the ability to work with distributed, cross-functional teams.\n\nAbility to work independently, make sound decisions under pressure, and manage competing priorities.\n\nPreferred Qualifications\nExperience with Microsoft Sentinel, Microsoft Defender, Log Analytics, SOAR, or comparable platforms.\n\nFamiliarity with MITRE ATT&CK, Sigma, YARA, threat hunting, or detection testing.\n\nExperience with infrastructure-as-code, CI/CD, containers, or Kubernetes security.\n\nExperience securing LLMs, AI agents, MCP or plugin ecosystems, AI-enabled SaaS tools, or AI runtime environments is a plus.\n\nExperience with endpoint security capabilities such as endpoint privilege management, privileged access workstations, application control, and other least-privilege or attack-surface-reduction measures.\n\nExperience supporting SOC 2, ISO 27001, NIST, FedRAMP, or similar assurance requirements.\n\nRelevant security certifications or equivalent practical experience.\n\nSuccess Measures\nImproved detection coverage and alert quality across priority security signals.\n\nConsistent, risk-based triage and remediation of vulnerability, endpoint patching, and CSPM/CWP findings, with measurable improvement in patch compliance and endpoint-hardening coverage.\n\nReduced time to detect, investigate, contain, and recover from security incidents.\n\nIncreased automation and reduced manual effort in recurring SecOps workflows.\n\nReliable operational metrics, current playbooks, and measurable improvement actions.\n\nStrong execution across SecOps, Cloud Security, Identity and IT, AppSec, and Engineering teams.\n\nAI tools and agent workflows operate with risk-based guardrails, auditable telemetry, actionable detections, and clear escalation paths.\n\nControlled AI pilots demonstrate the least privilege, sandboxing, human approval, and safe handling of sensitive data before wider rollout.\n\nWhy Join Semperis? \nYou’ll be part of a global team on the front lines of cybersecurity innovation. At Semperis, we celebrate curiosity, integrity, and people who take initiative. If you’re someone who sees the glass as half full, embraces challenges as growth opportunities, and values a healthy balance between work and life-we’d love to meet you.\n**Semperis maintains office locations in several cities across the globe. Where the job description specifies a required location, candidates will follow our hybrid work model. This includes working up to three days per week and remotely the remaining days.\nSemperis is an equal opportunity employer and will not discriminate against an applicant or employee based on race, color, religion, creed, national origin or ancestry, ethnicity, sex (including gender, pregnancy, sexual orientation, and gender identity), age, physical or mental disability, veteran or military status, genetic information, citizenship, marital status, or any other legally recognized protected basis under federal, state, or local law. The information collected by the Semperis application is solely to determine suitability for employment, verify identity, and maintain employment statistics.\nApplicants with disabilities may be entitled to reasonable accommodation under the Americans with Disabilities Act and/or other applicable state or local laws. A reasonable accommodation is a change in the way things are normally done which will ensure an equal employment opportunity without imposing undue hardship on Semperis. Please inform Semperis representative Anna Taylor, Director of Global Recruiting, if you need assistance completing this application or to otherwise participate in the application process.","description_format":"text","description_chars":10047,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Growth opportunities","Hybrid work"],"hiring_locations":[{"name":"Israel","iso":"IL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","Incident Response"],"lifecycle":[{"event":"open","at":"2026-09-11T02:26:33Z"},{"event":"close","at":"2026-09-25T23:40:02Z"},{"event":"reopen","at":"2026-09-28T14:09:34Z"},{"event":"close","at":"2026-09-29T01:38:35Z"},{"event":"reopen","at":"2026-09-29T23:11:25Z"}],"visa":[],"liveness":{"score":26,"band":"fade","label":"Fading","p_open":1,"p_active":0.71,"p_room":0.36,"age_days":81,"expected_fill_days":43,"reasons":["conf:2","velocity","win:tail","crowd:"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/semperis-senior-secops-engineer","json_url":"https://alion.io/job/semperis-senior-secops-engineer.json","meta":{"generated_at":"2026-11-01T10:58:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16894,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":685815},"rest":"https://alion.io/mcp/rest/get_company?id=685815"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsemperis-senior-secops-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsemperis-senior-secops-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsemperis-senior-secops-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/semperis-senior-secops-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsemperis-senior-secops-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":698496}},{"tool":"search_jobs","arguments":{"company":"semperis.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":698496},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}